Cross-source coverage

T1210 / ATT&CK

Exploitation of Remote Services

229 rules · 221 families across 10 sources.

Showing deprecated rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. A common goal for post-compromise exploitation of remote services is for lateral movement to enable access to a remote system.

An adversary may need to determine if the remote system is in a vulnerable state, which may be done through Network Service Discovery or other Discovery methods looking for common, vulnerable software that may be deployed in the network, the lack of certain patches that may indicate vulnerabilities, or security software that may be used to detect or contain remote exploitation. Servers are likely a high value target for lateral movement exploitation, but endpoint systems may also be at risk if they provide an advantage or access to additional resources.

There are several well-known vulnerabilities that exist in common services such as SMB and RDP as well as applications that may be used within internal networks such as MySQL and web server services. Additionally, there have been a number of vulnerabilities in VMware vCenter installations, which may enable threat actors to move laterally from the compromised vCenter server to virtual machines or even to ESXi hypervisors.

Depending on the permissions level of the vulnerable remote service an adversary may achieve Exploitation for Privilege Escalation as a result of lateral movement exploitation as well.

Platforms
Linux · Windows · macOS · ESXi
Telemetry
WinEventLog:SystemWinEventLog:SysmonNSM:Flowlinux:syslogauditd:SYSCALLesxi:hostdmacos:unifiedlogmacos:osquery

How MITRE says to detect it DET0118

Exploitation of Remote Services – multi-platform lateral movement detection

Windows Analytic 0327

Correlates inbound network access to remote service ports (e.g., SMB/RPC 445/135, RDP 3389, WinRM 5985/5986) with near-time instability in the target service (crash, abnormal restart), suspicious child process creation under the service, and post-access lateral-movement behaviors. The chain indicates likely exploitation rather than normal administration.

  • WinEventLog:System EventCode=1000
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=3, 22
  • WinEventLog:Sysmon EventCode=7
  • WinEventLog:Sysmon EventCode=10
  • WinEventLog:Sysmon EventCode=11
  • NSM:Flow Inbound connections to 445, 3389, 5985-5986 with high error/connection-reset rate, followed by new outbound sessions from the same host to internal assets within short interval.

Linux Analytic 0328

Links inbound network access to SSHD/SMB/NFS/Databases or custom daemons with subsequent daemon crash/restart, core dump, or spawning of shells/reverse shells from the service context, indicating remote exploitation.

  • linux:syslog kernel|systemd messages indicating 'segmentation fault'|'core dumped'|'service terminated unexpectedly' for sshd, smbd, vsftpd, mysqld, httpd, etc.
  • auditd:SYSCALL execve of /bin/sh,/bin/bash,/usr/bin/curl,/usr/bin/python by service accounts (e.g., apache, mysql, nobody) immediately after inbound network activity.
  • NSM:Flow Inbound connections to monitored service ports from external or unusual internal sources; rapid follow-on lateral connections from the same host.

ESXi Analytic 0329

Detects exploitation targeting ESXi/vCenter by correlating attempts to reach known exploitable endpoints (OpenSLP 427, CIM 5989, Hostd/Vpxa HTTPS 443, ESXi SOAP) with vmkernel/hostd crashes, unexpected hostd/vpxa restarts, or new reverse/outbound connections from ESXi host/vCenter to internal assets.

  • esxi:hostd Keywords: 'Backtrace','Signal 11','PANIC','hostd restarted','assert' or 'Service terminated unexpectedly' in /var/log/hostd.log, /var/log/vmkernel.log, /var/log/syslog.log.
  • NSM:Flow Inbound to tcp/427 (OpenSLP), tcp/443 (vSphere APIs), tcp/902, tcp/5989 followed by new unexpected outbound sessions from the ESXi/vCenter host.

macOS Analytic 0330

Ties inbound access to exposed services (ARD/VNC 5900, SSH 22, ScreenSharing, web services) with process crashes in unified logs and abnormal child processes spawned under those services (e.g., bash, curl) to indicate exploitation.

  • macos:unifiedlog process 'crashed'|'EXC_BAD_ACCESS' for sshd, screensharingd, httpd; launchd restarts of these daemons.
  • macos:osquery parent_name in ('sshd','httpd','screensharingd') spawning shells or scripting runtimes.
  • NSM:Flow Inbound to 22/5900/8080 and follow-on internal connections.

View on attack.mitre.org ↗

Emerging Threats Open

146 rules · 139 families
Detection Severity Format
ET EXPLOIT Cisco IOS XE Web UI Command Injection Vulnerability (CVE-2023-20273) Critical Suricata
ET EXPLOIT DynoRoot DHCP - Client Command Injection Critical Suricata
ET EXPLOIT HP Smart Storage Administrator Remote Command Injection Critical Suricata
ET EXPLOIT VMware NSX SD-WAN Command Injection Critical Suricata
ET EXPLOIT VMware NSX SD-WAN Command Injection 2 Critical Suricata
ET DELETED Pre Projects E-Smart Cart login.asp Arbitrary SQL Command Injection Attempt High Suricata
ET EXPLOIT Attempted Remote Command Injection Inbound (CVE-2018-7841) High Suricata
ET EXPLOIT Attempted Remote Command Injection Inbound (CVE-2019-3929) High Suricata
ET EXPLOIT Attempted Remote Command Injection Outbound (CVE-2018-7841) High Suricata
ET EXPLOIT Attempted Remote Command Injection Outbound (CVE-2019-3929) High Suricata

+ 136 more from Emerging Threats Open → showing the 10 highest-severity

elastic/detection-rules

23 rules
Detection Severity Format
Malicious Remote File Creation Critical Elastic TOML
Potential Telnet Authentication Bypass (CVE-2026-24061) Critical Elastic TOML
Telnet Authentication Bypass via User Environment Variable Critical Elastic TOML
Azure AKS Kubelet Proxy to Command Execution Endpoint High Elastic TOML
Unusual Child Process of dns.exe High Elastic TOML
Abnormally Large DNS Response Medium Elastic TOML
Azure AKS API Server Proxying Request to Kubelet Medium Elastic TOML
Deprecated - Remote File Creation on a Sensitive Directory Medium Elastic TOML
Microsoft Exchange Server UM Spawning Suspicious Processes Medium Elastic TOML
Microsoft Exchange Server UM Writing Suspicious Files Medium Elastic TOML

+ 13 more from elastic/detection-rules → showing the 10 highest-severity

Wazuh Core Ruleset

17 rules
Detection Severity Format
Buffer overflow attack on rpc.statd Critical Wazuh XML
Buffer overflow on WU-FTPD versions prior to 2.6 Critical Wazuh XML
Heap overflow in the Solaris cachefsd service. Critical Wazuh XML
Printer driver failed to load, possible remote code execution using PrinterNightmare exploit: CVE-2021-34527. Critical Wazuh XML
sshd: OpenSSH challenge-response exploit. Critical Wazuh XML
sshd: SSH CRC-32 Compensation attack Critical Wazuh XML
MS Exchange - Possible ProxyLogon vulnerability exploitation (CVE-2021-26855). High Wazuh XML
MS Exchange - Possible ProxyLogon vulnerability exploitation (CVE-2021-27065). High Wazuh XML
Possible Nishang Invoke-PowerShellTcpOneLine reverse shell script execution High Wazuh XML
ProFTPD: FTP process crashed. High Wazuh XML

+ 7 more from Wazuh Core Ruleset → showing the 10 highest-severity

SigmaHQ/sigma

15 rules
Detection Severity Format
Audit CVE Event Critical Sigma
WannaCry Ransomware Activity Critical Sigma
Zerologon Exploitation Using Well-known Tools Critical Sigma
Exploitation Attempt Of CVE-2020-1472 - Execution of ZeroLogon PoC High Sigma
Exploitation Attempt Of CVE-2023-46214 Using Public POC Code High Sigma
HackTool - SharpWSUS/WSUSpendu Execution High Sigma
OMIGOD HTTP No Authentication RCE - CVE-2021-38647 High Sigma
Possible Exploitation of Exchange RCE CVE-2021-42321 High Sigma
Scanner PoC for CVE-2019-0708 RDP RCE Vuln High Sigma
Terminal Service Process Spawn High Sigma

+ 5 more from SigmaHQ/sigma → showing the 10 highest-severity

splunk/security_content

9 rules
Detection Severity Format
Active Directory Lateral Movement Identified Undefined SPL
Cisco Secure Firewall - Lumma Stealer Activity Undefined SPL
Cisco Secure Firewall - Static Tundra Smart Install Abuse Undefined SPL
Cisco Secure Firewall - Veeam CVE-2023-27532 Exploitation Activity Undefined SPL
Detect Computer Changed with Anonymous Account Undefined SPL
Linux Suspicious Redis Activity Undefined SPL
Splunk RCE Through Arbitrary File Write to Windows System Root Undefined SPL
Splunk RCE via User XSLT Undefined SPL
VMWare Aria Operations Exploit Attempt Undefined SPL

elastic/protections-artifacts

7 rules
Detection Severity Format
Payload Downloaded via Curl or Wget by Web Server Undefined Elastic TOML
Payload Execution by Node.js Web Server Undefined Elastic TOML
Payload Execution by Web Server Undefined Elastic TOML
Potential Remote Code Execution via Database Server Undefined Elastic TOML
Potential Remote Code Execution via Mail Server Undefined Elastic TOML
Potential Telnet Authentication Bypass (CVE-2026-24061) Undefined Elastic TOML
Suspicious Web Server Child Process Undefined Elastic TOML

chronicle/detection-rules

5 rules
Detection Severity Format
ttp_sharepoint_cve_2025_49706_exploitation High YARA-L
anonymous_user_changed_machine_password Undefined YARA-L
burp_suite_scanner_and_burp_collaborator_detected_via_proxy Undefined YARA-L
potential_rdp_exploit_cve20190708 Undefined YARA-L
scanner_poc_for_cve20190708_rdp_rce_vuln Undefined YARA-L

socfortress/Wazuh-Rules

4 rules
Detection Severity Format
Sysmon - Event 12: RegistryEvent (Object create and delete) by · Exploitation of Remote Services (T1210) Low Wazuh XML
Sysmon - Event 13: RegistryEvent (Value Set) by · Exploitation of Remote Services (T1210) Low Wazuh XML
Sysmon - Event 14: RegistryEvent (Key and Value Rename) by · Exploitation of Remote Services (T1210) Low Wazuh XML
Sysmon - Event 7: Image loaded by · Exploitation of Remote Services (1210) Low Wazuh XML

Bert-JanP/Hunting-Queries-Detection-Rules

2 rules
Detection Severity Format
LDAPNightmare Exploitation Attempt Undefined KQL
MITRE ATT&CK Mapping Undefined KQL

Azure/Azure-Sentinel

1 rule
Detection Severity Format
Gain Code Execution on ADFS Server via Remote WMI Execution Medium KQL

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.